<?php
session_start();

require_once 'db/config.php';

if (!function_exists('normalizeLoginIdentifier')) {
    function normalizeLoginIdentifier(string $value): string
    {
        $value = trim($value);
        return function_exists('mb_strtolower') ? mb_strtolower($value, 'UTF-8') : strtolower($value);
    }
}

if (!function_exists('normalizeSessionRole')) {
    function normalizeSessionRole(?string $role): string
    {
        $role = normalizeLoginIdentifier((string) ($role ?? ''));

        $aliases = [
            'administrador' => 'admin',
            'admin' => 'admin',
            'asesor' => 'asesor',
            'marketing' => 'marketing',
            'control logistico' => 'control_logistico',
            'control_logistico' => 'control_logistico',
            'soporte logistico' => 'soporte_logistico',
            'soporte_logistico' => 'soporte_logistico',
            'verificador de pagos' => 'verificador_pagos',
            'verificador_pagos' => 'verificador_pagos',
            'logistica' => 'logistica',
        ];

        return $aliases[$role] ?? $role;
    }
}

if (isset($_SESSION['user_id'])) {
    $currentRole = (string) ($_SESSION['user_role'] ?? '');
    if (in_array($currentRole, ['Administrador', 'admin'], true)) {
        header('Location: dashboard_principal.php');
    } elseif (strcasecmp(trim($currentRole), 'Marketing') === 0) {
        header('Location: marketing_produccion.php');
    } elseif (strcasecmp(trim($currentRole), 'Asesor') === 0) {
        header('Location: kanban.php');
    } else {
        header('Location: pedidos.php');
    }
    exit();
}

$error = '';
$submittedUsername = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim((string) ($_POST['username'] ?? ''));
    $password = (string) ($_POST['password'] ?? '');
    $submittedUsername = $username;

    if ($username === '' || $password === '') {
        $error = 'Please enter both username and password.';
    } else {
        try {
            $db = db();
            $lookup = normalizeLoginIdentifier($username);

            $stmt = $db->prepare('SELECT * FROM users WHERE LOWER(TRIM(username)) = :identifier LIMIT 1');
            $stmt->bindValue(':identifier', $lookup, PDO::PARAM_STR);
            $stmt->execute();
            $user = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$user) {
                $stmt = $db->prepare("SELECT * FROM users WHERE LOWER(TRIM(COALESCE(nombre_asesor, ''))) = :identifier LIMIT 1");
                $stmt->bindValue(':identifier', $lookup, PDO::PARAM_STR);
                $stmt->execute();
                $user = $stmt->fetch(PDO::FETCH_ASSOC);
            }

            if ($user && password_verify($password, (string) ($user['password'] ?? ''))) {
                $_SESSION['user_id'] = $user['id'];
                $_SESSION['username'] = trim((string) ($user['username'] ?? ''));
                $_SESSION['user_role'] = (string) ($user['role'] ?? '');
                $_SESSION['role'] = normalizeSessionRole((string) ($user['role'] ?? ''));
                $_SESSION['nombre_asesor'] = trim((string) ($user['nombre_asesor'] ?? ''));

                // Record session
                try {
                    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
                    $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
                    $ciudad = 'Desconocida';

                    if ($ip !== 'unknown' && $ip !== '127.0.0.1' && $ip !== '::1') {
                        $geo = @file_get_contents("http://ip-api.com/json/{$ip}?fields=city");
                        if ($geo) {
                            $geoData = json_decode($geo, true);
                            if (isset($geoData['city'])) {
                                $ciudad = $geoData['city'];
                            }
                        }
                    }

                    $stmtSession = $db->prepare('INSERT INTO user_sessions (user_id, ip_address, ciudad, user_agent) VALUES (:user_id, :ip, :ciudad, :ua)');
                    $stmtSession->bindParam(':user_id', $user['id']);
                    $stmtSession->bindParam(':ip', $ip);
                    $stmtSession->bindParam(':ciudad', $ciudad);
                    $stmtSession->bindParam(':ua', $ua);
                    $stmtSession->execute();
                } catch (PDOException $e) {
                    // Silently fail if session recording fails, don't block login
                }

                $userRole = (string) ($user['role'] ?? '');
                if (in_array($userRole, ['Administrador', 'admin'], true)) {
                    header('Location: dashboard_principal.php');
                } elseif (strcasecmp(trim($userRole), 'Marketing') === 0) {
                    header('Location: marketing_produccion.php');
                } elseif (strcasecmp(trim($userRole), 'Asesor') === 0) {
                    header('Location: kanban.php');
                } else {
                    header('Location: pedidos.php');
                }
                exit();
            } elseif ($user) {
                $error = 'Invalid password.';
            } else {
                $error = 'We could not find an account with that username or advisor name.';
            }
        } catch (PDOException $e) {
            $error = 'Database error: ' . $e->getMessage();
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login - FLOWERSEGUIMIENTOPEDIDOS</title>
    <meta property="og:title" content="FLOWERSEGUIMIENTOPEDIDOS">
    <meta property="og:image" content="">
    <meta name="twitter:card" content="summary_large_image">
    <meta name="twitter:image" content="">
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="assets/css/style.css">
</head>
<body>
    <div class="container">
        <div class="row justify-content-center">
            <div class="col-md-6 col-lg-4">
                <div class="card mt-5">
                    <div class="card-body">
                        <h3 class="card-title text-center">Login</h3>
                        <?php if ($error): ?>
                            <div class="alert alert-danger"><?php echo htmlspecialchars($error); ?></div>
                        <?php endif; ?>
                        <form method="POST">
                            <div class="mb-3">
                                <label for="username" class="form-label">Username</label>
                                <input type="text" class="form-control" id="username" name="username" value="<?php echo htmlspecialchars($submittedUsername); ?>" required>
                            </div>
                            <div class="mb-3">
                                <label for="password" class="form-label">Password</label>
                                <input type="password" class="form-control" id="password" name="password" required>
                            </div>
                            <button type="submit" class="btn btn-primary w-100">Login</button>
                        </form>
                    </div>
                </div>
            </div>
        </div>
    </div>
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>